Paul H is a user on social.device5.co.uk. You can follow them or interact with them if you have an account anywhere in the fediverse.
Paul H @paul

Gmail enters the "extend" phase of Embrace, Extend, Extinguish by creating new proprietary features for email then forcing non-gmail users the view the mail through a link with Google Login (and sometimes SMS confirmation!)

arstechnica.com/gadgets/2018/0

· 185 · 94

@paul guess it's time to get on Protonmail's paid plan...

@Antanicus

I agree. Support other email providers. google obviously feel they have a critical mass of users now that this move is worth it.

If I ever receive one of these links I will ask the sender to use another method

@paul

Worth remembering even for self-hosters:

mako.cc/copyrighteous/google-h

Network effects increase the extent to which *other* people's choices affect us.

@Antanicus

@paul @Antanicus @ritjoe totally true, but I would rather they had some of my email rather than all of it. Plus moving away yourself encourages others to do so and keeps the alternatives viable

@bgcarlisle @Antanicus Ah is this why gmail has adopted something similar? Worried about the competition.

I wonder if the two implementations are interoperable? (I'll take a guess and say no!)

Yeah I'm not in favour of Proton Mail doing it either, although I don't know if they require a login and/or sms verification to view the mail.

Maybe best look at another provider or do what I do and self-host.

@paul @Antanicus I mean, I don't think it will be used, or that it's a threat to email

I've had this feature on Protonmail for months and it's just not that useful, nor is it evil

I think the bigger threat is how Gmail kinda-sorta blocks smaller email providers

And I would highly recommend Protonmail, btw

@bgcarlisle @Antanicus I'd say it's more of a worry when gmail does it because of how much of control they have over the email ecosystem. Once they can start dictating protocol changes then we're in big trouble.

@paul @Antanicus Yeah true

I guess it's just not that useful a feature?

I'm trying to think of a really good use case, but it's not coming to me

@bgcarlisle @Antanicus yeah none of this is going to prevent screenshots or similar. Seems like the whole thing is a bit of security theatre

@paul then it's not email, and we can safely ignore it.

@paul The article didn't mention how this works with google's ad placement within gmail. Do you know? Or have google said? Scanning an email in order to place ads, a normal gmail function, doesn't seem very compatible with confidentiality. (I searched but only found other articles basically recapping the same info as the one you linked.)

@jannamark Apparently because of the upcoming GDPR Gmail no longer scans emails to help build advertising profiles

nytimes.com/2017/06/23/technol

But I don't think this new feature would make a difference anyway as it sounds like Google always has the keys any confidential email sent.

It would stop any competitors from reading the email though..

@paul And thus we enter the era of screenshot email saving 🙄

@paul And of course, Google will still read your confidential mail and monetize your data.

@phryk They claim they don't do that anymore, but there's no way of knowing for sure

@paul Even if that one is technically correct, they still have your complete social graph and I *highly* doubt, they'll ever stop using gmail metadata – it's just too damn valuable for them.

@phryk too right. They're too scared of Facebook to give all that up for nothing

I’ve been considering moving away from Gmail for a while now, but so much of my online identity is tied to that gmail account.

So many logins. So many rarely used services.

I don’t think I could get away with abandoning it entirely, but I could probably get another address set up with another service and start the migration? A domain I control, but hosted through a big service?

@paul

@ajroach42 If you're used to sysadmin tasks, setting up your own email server with postfix/dovecot and friends is pretty easy and once it's done, requires minimal maintenance. I've been running my own server for years.

If you don't have the time or desire, setting up a custom domain on Protonmail or Fastmail along with redirection for your old address should take no longer than an hour.

Then it's just a case of updating accounts to use the new address

@paul @ajroach42 Don't you effectively need a static IP with valid reverse DNS (in other words, time to get business class internet or a VPS) if you want mail to actually work?

@bhtooefr @paul if You’re going to actually self host, yes. But I have those things.

@paul @bhtooefr @ajroach42 I'm lucky, my isp provides a static IP for £1 per month so self hosting from home is easy. In the past I have also hosted from home on a dynamic ip with no reverse DNS and only ever had deliverability problems to hotmail addresses occasionally. There aren’t actually many servers that will block you just for having dynamic IP

@paul @bhtooefr And you haven't run in to problems where spam filters erroneously catch your emails?

That's my biggest worry against self hosting.

@bhtooefr @paul @ajroach42 no never. I make sure DKIM and SPF are good and deliverability is fine. The only issues have been Microsoft just dropping emails occasionally. There are loads of post on stack overflow and elsewhere where ppl suffer the same thing. Their servers say they have received the message and will deliver it, then it’s just dropped with the receiver never seeing the email.

@bhtooefr @paul @ajroach42 you have to find the well hidden MS tools to register ownership of your domain/IPs and that helps. Will send you a link once I’m near a computer. They also try to up sell you to a company called returnpath which will guarantee you always get delivered to Outlook/Hotmail for about $5000 dollars per year. It’s a total racket.

@paul I’ve done this in the past, but I ran in to trouble with the spam filters.

@ajroach42 @paul First step in getting away from GMail is an email address at your domain.

Doesn't matter where you host it. Just start transitioning to it, and you can change hosts at your leisure.

My email was first hosted with Google Apps, then with Cotse, and now with Fastmail (which I love and recommend.)

@paul I'm glad that I already began to transition from Gmail to @Tutanota.

@paul like ProtonMail haven't been doing the same for encrypting messages to non-PM users.

@tdemin if they have that’s bad (and do they require login and sms verification?), but they don’t have the same level of influence as gmail so it’s not much of a threat yet.

@paul @tdemin Protonmail only needs a passphrase to access a message not login/sms. They give a place for you to give a hint. Otherwise it's up to you to provide the shared secret outside of the email.

I'd prefer encryption at the user level via pgp, but this at least gives me the option to force people to embrace it if they want to read my message. My track record for selling pgp use is pretty much nil.

On the other hand, it vastly increases social engineering risk.

@fullywoolly @tdemin yeah I don't think there is anyone on earth that has managed to successfully get anyone else to use PGP unless they already had it set up and understood it!

Something like the signal protocol over email would be nice, but I think most ppl see email as being insecure forever sadly

@paul @tdemin my uncle managed to capture my imagination with pgp as a youth. I'll admit I haven't used it recently.

I agree with the signal approach. But even getting people on signal when they already have 14 others they use has also been an uphill struggle.

@paul

I hope this time people will realize that stallmann was right: all non-freesoftware is inherently evil.

@paul What are you talking about, they are never gonna remove the XMPP capabilities of Google talk, let alone replace it with something like Hangouts, that would be ridiculous!

@paul Let the unmitigated harassment with no paper trail BEGIN!

@paul
Proton mail has had something like this for a while I think

@paul Same is the case with ProtonMail's encrypted email that only works between users of the same email service, disregarding technologies like PGP which work irrespective of email providers.

Thunderbird's enigmail should be made easier to use. And a mobile version maybe. These should be recommended instead of ProtonMail.

#email #encryption #protonmail

@metalbob aye I agree with this, although not sure if PGP/GPG is simply too much for the average user to manage successfully over multiple devices without it ending in tragedy

@paul That article mentions an optional SMS code but not login. I guess it's no more confidential than email if it doesn't require login, though.

Definitely going to auto-reject these on my mail server.

@paul If I have to log into Google to view one of their screwball "self-destructing" emails I'm going to email the sender back and say "please send me a normal email". Proprietary extensions defeat the whole purpose of email, and the entire purpose of many emails is to be a semi-permanent record. Take that away and we may as well be communicating by smoke signals.

@paul looks like a solution in search of a problem... it's only going to be as secure as the end recipient's system (ignoring the blatant security hole of trusting Google to begin with), and while you may not be able to "forward, download or copy" the message I'd be incredibly surprised if they found a way to block screenshots...

@paul well, it's simple: if one day I receive an email that uses this feature, I simply reply the sender to send me the email again, without using that shitty function.

@paul Where is the part about requiring logging in with Google to view such a link? Am I missing it?

@tw that's an assumption on my part. Every time I have received links to google hosted content in the past the first thing I see is a login form. They would likely use it as a bypass for receiving the sms to view the message

@paul Could be. I saw an SMS passcode mention, but that appeared to be a feature the sender could choose to enable or not.
Even if this works without a login at the start, I don't trust Google to necessarily keep it that way, nor do I trust them not to continue with the Embrace, Extend, Extinguish pattern in some fashion. More importantly, another article pointed out there was no mention of encryption with this feature, either, so it sounds more like a gimmick than anything to me.

@tw yeah very likely. @unextro mentioned Microsoft have recently rolled out this feature for office365 so google are playing catch-up with them. Possible they just want to have the feature for that reason rather than as a true secure system.

It certainly sounds like something that bosses would like without thinking of the many ways it isn’t secure!

@paul Would like to point out that it's most likely in reaction to Micro$oft doing the same thing already... mastodon.social/@unextro/99864

@unextro oh they’re all at it! Tbh I thought this looked more like a Microsoft tactic Than google, and there it is!

I’ll actually be surprised if it does work “seamlessly” in outlook, because normal email doesn’t

@paul For all the talk about the new Microsoft it still look the same to me under the new coating.

Already in their usual game with PWAs... "PWAs installed via the store will ... have access to the full suite of WinRT APIs available to UWP apps. They can differentiate their experience on Windows 10 with enhancements like access to local calendar and contacts data (with permission) and more." (blogs.windows.com/msedgedev/20)

@unextro yes agreed. It surprises me that anyone thinks they have changed! Although maybe the comments I see are paid MS posts planted to sway opinion

@paul
ProtonMail already does this for encrypted emails. I'm not totally convinced this is necessarily malign... Well not when ProtonMail did it anyway.

@saltorito I dunno, they could have made it more like proton’s version with a password instead of a login / sms. It just seems like another excuse to track and gather more info on people rather than just provide the service.

@paul Yeah, thinking about it, you are almost certainly correct.

@paul

collecting sms: all the better to stalk you IRL, my dear

(little red riding hood)

@saltorito

Or someone just write a weboob-ish thing that grabs the email and spits out a .eml file

@tomas yeah I didn’t think of that. Surely not hard to write a browser extension that does this or something similar

@paul

protonmail "forces" users to a secure message view platform which are stuck with legacy email

For other email accounts on vps hosting i have the server delete non-enceypted email after an edumacatuonal autoresponse

#privacy

@mysizepurple @paul

personally I always recommend #mailbox.
Hosted in germany with green energy.

If you're interested i can give you a coupon worth 3 € (3 months of service).
I'm not affiliated ; not sponsored ; i don't receive a single thing for recommending

@mysizepurple @paul

Plus, you can pay via mail. Paper money in paper mail.
Glorious #privacy laws of the past protect snail mail.

@upshotknothole @mysizepurple I like this. The Stallman approved payment method!

I host my own mail server so don't need the discount, will boost for visibility though 😀

@paul @mysizepurple

> I host my own mail server

the best way possible.

I'm not sure if I want to deal with spam handling just yet.
E-Mail seems to require more intervention than my current self hosted systems (which i touch every month to update and reboot, that's it)

@upshotknothole @mysizepurple It doesn't take much to keep spam at bay actually. Spamassassin and postgrey do a great job. Plus you can easily train Spamassassin to show it what is/isn't spam so it just gets better over time.

Plus there are other tweaks you can make to Postfix to be more restrictive over what it allows to connect and/or send to your server.

Since January this year I've had one spam email that didn't get caught before making it to inbox, so not too bad

@paul @mysizepurple Oh wow. Maybe I should try that out some times soon ... :3

@paul companies have been doing this for years, especially in the health care industry.

@astraluma yeah it’s very tempting to lock people in to using proprietary features. Especially scary in healthcare. When the end goal is profit and market share end user goals aren’t always aligned with the vendor I guess

@paul actually, in that case, I think it's the complete unusability of pgp and s/mine and a strong business need for secure mail.

@paul Ugh. Now I have to kill my gmail, don't I? What a pain. I'm gonna have to migrate so many damn things... :/

Any advice for a better email provider? Is riseup.net any good? :0

@Angle @paul There are good reasons to not use GMail anyway. If anything this kind of behavior highlights the other ones. Having a few big providers (or one big provider) everyone uses just invites this kind of thing.

GMail's over-aggressive antispam policies that make it increasingly difficult for independent providers to host mailing lists and drive people into the TRULY AWFUL GOOGLE GROUPS is another example.

@satchmoz @Angle yes I’ve heard good things about posted.de. Riseup is also good, although you will need an invite from an existing member

@Angle @satchmoz ask around on the fediverse for an invite. Someone will likely have one they’re happy to give out

@Angle here there's an extensive comparison and evaluation of possible alternatives thatoneprivacysite.net/email-s
I personally went for fastmail and tutanota, but the choice is really tailored to your specific needs and threat model

@charlyblack I already signed up to riseup.net. Thank you for the link though, I'll check through it if I want another email. XD

@Angle they didn't have some features I needed, but I am a big fan of the collective, they are 👌 👌 👌

@charlyblack
That link is super helpful. I'm looking to migrate off Google as well, and I'll be looking over this and picking someone to use tonight I think. :)
@Angle

@paul that seems to be about as likely to work as...

what was their failed social called? Was it Buzz or something? I can't even remember.

@rook haha yeah buzz. That was a monumental failure!

@paul
Everyone should treat these like a phishing attempt through a third party because that is what they are.

@DistroJunkie Agreed. Phishing for personal info of non-gmail users